The submit_password() method in Concrete CMS 9.5.0 and earlier bypasses the view_file permission check, allowing any user to download files regardless of authorization. Files without passwords can be retrieved directly, and password‑protected files can be downloaded if the attacker knows the password, irrespective of the user's permissions. This missing‑authorization vulnerability (CWE‑862) enables unauthorized disclosure of file contents. The CVE description states that the download permission check is bypassed when downloading files protected by a password or restricted by a view_file permission.

Concrete CMS: Concrete CMS, version 9.5.0 and all earlier releases are affected.

The CVSS score of 6.3 indicates a moderate severity flaw. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote over the network where an attacker accesses the /concrete/controllers/single_page/download_file.php endpoint. An attacker who identifies a file's password can download that file even if they lack proper permissions. The vulnerability can be exploited without needing elevated privileges or pre‑existing user access, relying solely on knowledge of file passwords and the existence of the download endpoint.